Method and apparatus for using a multi-factor password or a dynamic password for enhanced security on a device

Abstract

Techniques for improving security on a device are disclosed. In an aspect, a multi-factor password comprising a plurality of factors may be used to improve security. Each factor may correspond to a different type of information that may be used for authentication and/or other purposes. For example, the plurality of factors may include an alpha-numeric string, a fingerprint of a user, a voice clip, a picture, a video, etc. The device may authenticate the user based on the multi-factor password. In another aspect, a dynamic password that varies with at least one parameter (e.g., time, location, etc.) may be used to improve security. The dynamic password may have a plurality of values for a plurality of scenarios defined by at least one parameter. The device may authenticate a user in a given scenario based on a value of the dynamic password applicable for that scenario.

What is claimed is: 
     
       1. A method of performing authentication on a device for a user, comprising:
 allowing creation of a user-defined password by the user, the user-defined password including a plurality of factors corresponding to different types of information used to authenticate the user entered in a user-defined predetermined order; 
 storing the user-defined password; 
 receiving a password at the time of authentication including the plurality of factors corresponding to the different types of information from the user without prompting the user as to the user-defined predetermined order; and 
 authenticating the user based on determining whether all of the plurality of factors of the received password match all of the plurality factors of the stored user-defined password, wherein the authentication is successful only when all of the plurality of factors comprised in the received password are received in the user-defined predetermined order that matches the user-defined predetermined order of the stored user-defined password. 
 
     
     
       2. The method of  claim 1 , wherein the plurality of factors comprise an alpha-numeric string, or a fingerprint of the user, or a voice clip, or a picture, or a video, or cursor action, or a biometric of the user, or orientation of the device, or motion of the device, or a combination thereof. 
     
     
       3. The method of  claim 1 , further comprising:
 recording information for the plurality of factors of the user-defined password during a training phase; and 
 storing the recorded information for the plurality of factors of the user-defined password. 
 
     
     
       4. The method of  claim 1 , wherein the authenticating the user comprises
 receiving entered information for the plurality of factors of the password, 
 comparing the entered information for the plurality of factors against recorded information for the plurality of factors, and 
 determining whether the user is authenticated based on a result of the comparing. 
 
     
     
       5. The method of  claim 4 , wherein the comparing the entered information comprises comparing entered information for a k-th factor entered for the password against recorded information for a k-th factor of the user-defined password, with k running from 1 to K, and K being a number of factors of the user-defined password, and wherein the determining whether the user is authenticated comprises declaring the user to be authenticated if the entered information for the k-th factor entered for the password matches the recorded information for the k-factor of the user-defined password, with k running from 1 to K. 
     
     
       6. The method of  claim 1 , wherein the user-defined password comprises only one instance of each of the plurality of factors. 
     
     
       7. The method of  claim 1 , wherein the user-defined password comprises multiple instances of at least one of the plurality of factors. 
     
     
       8. The method of  claim 1 , further comprising:
 storing recorded information for the plurality of factors of the user-defined password in at least two different formats. 
 
     
     
       9. The method of  claim 1 , further comprising:
 obtaining recorded information for the plurality of factors; 
 encrypting the recorded information for the plurality of factors; and 
 storing the encrypted recorded information for the plurality of factors. 
 
     
     
       10. An apparatus for performing authentication for a user, comprising:
 means for allowing creation of a user-defined password by the user, the user-defined password including a plurality of factors corresponding to different types of information used to authenticate the user entered in a user-defined predetermined order; 
 means for storing the user-defined password; 
 means for receiving a password at the time of authentication including the plurality of factors corresponding to the different types of information from the user without prompting the user as to the user-defined predetermined order; and 
 means for authenticating the user based on determining whether all of the plurality of factors of the received password match all of the plurality factors of the stored user-defined password, wherein the authentication is successful only when all of the plurality of factors comprised in the received password are received in the user-defined predetermined order that matches the user-defined predetermined order of the stored user-defined password. 
 
     
     
       11. The apparatus of  claim 10 , further comprising:
 means for recording information for the plurality of factors of the user-defined password during a training phase; and 
 means for storing the recorded information for the plurality of factors of the user-defined password. 
 
     
     
       12. The apparatus of  claim 10 , wherein the means for authenticating the user comprises:
 means for receiving entered information for the plurality of factors of the password, 
 means for comparing the entered information for the plurality of factors against recorded information for the plurality of factors, and 
 means for determining whether the user is authenticated based on a result of the comparing. 
 
     
     
       13. The apparatus of  claim 12 , wherein at least one processor is configured to record information for the plurality of factors of the user-defined password during a training phase, and to store the recorded information for the plurality of factors of the user-defined password. 
     
     
       14. The apparatus of  claim 12 , wherein at least one processor is configured to receive entered information for the plurality of factors of the password, to compare the entered information for the plurality of factors against recorded information for the plurality of factors, and to determine whether the user is authenticated based on a result of the comparing. 
     
     
       15. A computer program product to perform authentication for a user, comprising:
 a computer-readable medium comprising:
 code for causing at least one processor to allow creation of a user-defined password by the user, the user-defined password including a plurality of factors corresponding to different types of information used to authenticate the user entered in a user-defined predetermined order; 
 code for causing at least one processor to store the user-defined password; 
 code for causing at least one processor to receive a password at the time of authentication including the plurality of factors corresponding to the different types of information from the user without prompting the user as to the user-defined predetermined order; and 
 code for causing the at least one processor to authenticate the user based on determining whether all of the plurality of factors of the received password match all of the plurality factors of the stored user-defined password, wherein the authentication is successful only when all of the plurality of factors comprised in the received password are received in the user-defined predetermined order that matches the user-defined predetermined order of the stored user-defined password. 
 
 
     
     
       16. The computer program product of  claim 15 , the computer-readable medium further comprising:
 code for causing the at least one processor to record information for the plurality of factors of the user-defined password during a training phase, and 
 code for causing the at least one processor to store the recorded information for the plurality of factors of the user-defined password. 
 
     
     
       17. The computer program product of  claim 15 , the computer-readable medium further comprising:
 code for causing the at least one processor to receive entered information for the plurality of factors of the password, 
 code for causing the at least one processor to compare the entered information for the plurality of factors against recorded information for the plurality of factors, and 
 code for causing the at least one processor to determine whether the user is authenticated based on a result of the comparing.